<?php declare(strict_types=1); if (!defined('DASHBOARD_ROOT')) { http_response_code(403); exit('Direct access denied.'); } header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); exit(json_encode(['success' => false, 'error' => 'POST required.'])); } if (!AuthChain::isAuthenticated()) { http_response_code(401); exit(json_encode(['success' => false, 'error' => 'Not authenticated.'])); } CSRF::enforce(); $entity = $_POST['entity'] ?? ''; $id = (int)($_POST['id'] ?? 0); if ($id <= 0) exit(json_encode(['success' => false, 'error' => 'Valid ID required.'])); $adminId = $_SESSION['admin_id']; $entityConfig = [ 'listing' => ['table' => 'products', 'perm' => 'delete.listing', 'col' => 'status_code', 'val' => 3005], 'category' => ['table' => 'categories','perm' => 'delete.content', 'col' => 'status_code', 'val' => 6099], 'faq' => ['table' => 'faq', 'perm' => 'delete.content', 'col' => 'status_code', 'val' => 6099], 'content_block' => ['table' => 'content_blocks', 'perm' => 'delete.content', 'col' => 'is_active', 'val' => 0], 'review' => ['table' => 'reviews', 'perm' => 'delete.content', 'col' => 'is_approved', 'val' => 0], 'legal_content' => ['table' => 'legal_content', 'perm' => 'delete.content', 'col' => 'is_active', 'val' => 0], ]; if (!isset($entityConfig[$entity])) { exit(json_encode(['success' => false, 'error' => 'Cannot delete this entity type.'])); } $cfg = $entityConfig[$entity]; RBAC::enforce($cfg['perm']); $col = $cfg['col']; $val = $cfg['val']; Database::execute("UPDATE {$cfg['table']} SET {$col} = :v, updated_at = NOW() WHERE id = :id", [':v' => $val, ':id' => $id]); Events::record(Events::CAT_DELETE, "{$entity}.soft_deleted", $entity, $id, [], $adminId); AuditLogger::log("{$entity}.soft_deleted", $entity, $id); echo json_encode(['success' => true]); exit; 